Systems and methods for validating predetermined events in reconfigurable control systems

ABSTRACT

Systems and methods for validating predetermined events in reconfigurable control systems are provided. One method includes receiving, by a plurality of redundant processors operating in a first mode, a notice from two of three redundant sensors that the predetermined event occurred and reconfiguring the plurality of redundant processors to operate in a second mode in response to the notice. Another method includes receiving a first notice that one or more sensors detected that a first vehicle is coupled to a second vehicle at a primary control system and a secondary control system and reconfiguring the primary control system and the secondary control system to operate in another mode at substantially the same time in response to the notice.

FIELD OF THE INVENTION

The present invention generally relates to the field of computer platform control systems used in, for example, spacecraft, aircraft, motor vehicle, and the like, and more specifically to systems and methods for validating predetermined events in reconfigurable control systems.

BACKGROUND OF THE INVENTION

Aircraft and space vehicle control systems are responsible for controlling various systems in an aircraft, such as “fly by wire” guidance and navigation systems, aircraft lighting systems, aircraft environmental control systems, aircraft flight control systems, and aircraft flight management systems. Over time, different types of vehicle control systems have been proposed to provide control functionality while minimizing size, weight, and cost.

One type of control system is disclosed in U.S. Pat. No. 7,421,526 entitled RECONFIGURABLE VIRTUAL BACKPLANE ARCHITECTURE issued to Fletcher et al., the contents of which are incorporated herein. This control system utilizes a reconfigurable virtual backplane system comprising a communication bus and at least two line cards. Each of the line cards are coupled to the communication bus and comprise a processor and a separate configuration memory coupled to the processor. The configuration memory comprises an array of configuration tables, wherein each configuration table stores a listing of processes to run and data to be transmitted to or received by the processor from the communication bus. A current configuration table is selected from the array of configuration tables upon the occurrence of a predetermined event such that the control system is able to dynamically reconfigure itself upon the occurrence of various predetermined events (e.g., two spacecraft docking with one another).

Another control system is disclosed in co-pending U.S. patent application Ser. No. 12/473,837 entitled RECONFIGURABLE VIRTUAL BACKPLANE SYSTEMS AND METHODS filed by Nigoghosian et al., the contents of which are incorporated herein. This control system utilizes a communication bus and first and second line cards coupled to the communication bus. The first line card includes a first processor comprising a first system memory storing a first array of configuration tables. Each configuration table in the first array stores a listing of processes to be transmitted to or received from the communication bus, wherein a first configuration table is selected from the first array during a first configuration (e.g., an undocked spacecraft). The second line card includes a second processor comprising a second system memory storing a second array of configuration tables. Each configuration table in the second array stores a listing of processes to be transmitted to or received from the communication bus, wherein a second configuration table is selected from the second array of configuration tables during a second configuration (e.g., the spacecraft docked with another spacecraft).

Prior to reconfiguring the control systems in a spacecraft, an aircraft, a motor vehicle, or the like, it is important to ensure that the predetermined event(s) and/or the change in configuration have occurred. Accordingly, it is desirable to provide systems and methods for validating predetermined events and/or configurations in reconfigurable control systems. Furthermore, other desirable features and characteristics of the present invention will become apparent from the subsequent detailed description of the invention and the appended claims, taken in conjunction with the accompanying drawings and this background of the invention.

BRIEF SUMMARY OF THE INVENTION

Various embodiments provide methods for validating the occurrence of a predetermined event in a plurality of redundant processors operating in a first mode coupled to three redundant sensors. One method comprises the steps of receiving, by the plurality of redundant processors, a notice from two of the three redundant sensors that the predetermined event occurred and reconfiguring the plurality of redundant processors to operate in a second mode in response to the notice.

Other embodiments provide methods for validating that a first vehicle operating in a first mode is coupled to a second vehicle operating in a second mode, the first vehicle comprising a primary control system, a secondary control system for the control system, and a sensor coupled to the primary control system and the secondary control system. One method comprises the steps of receiving a notice that the sensor detected that the first vehicle is coupled to the second vehicle at the primary control system and the secondary control system, and reconfiguring the primary control system and the secondary control system to operate in a different mode at substantially the same time in response to the notice.

Methods for validating that a first vehicle operating in a first mode is coupled to a second vehicle operating in a second mode, the first vehicle comprising a primary control system, a secondary control system for the primary control system, a first sensor, a second sensor, and a third sensor coupled to the primary control system and the secondary control system are also provided. One method comprises the steps of receiving a notice that at least two of the first sensor, the second sensor, and the third sensor detected that the first vehicle is coupled to the second vehicle at the primary control system and the secondary control system, and reconfiguring the primary control system and the secondary control system to operate in a different mode at substantially the same time in response to the notice.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will hereinafter be described in conjunction with the following drawing figures, wherein like numerals denote like elements, and

FIG. 1 is a block diagram of one embodiment of a control system comprising a system for validating the occurrence of a predetermined event;

FIG. 2 is a block diagram of another embodiment of a control system comprising a system for validating the occurrence of a predetermined event;

FIG. 3 is a block diagram illustrating embodiments of predetermined events and/or change in configurations for two control systems similar to the embodiment illustrated in FIG. 1; and

FIG. 4 is a block diagram illustrating embodiments of predetermined events and/or change in configurations for two control systems similar to the embodiment illustrated in FIG. 2.

DETAILED DESCRIPTION OF THE INVENTION

The following detailed description of the invention is merely exemplary in nature and is not intended to limit the invention or the application and uses of the invention. Furthermore, there is no intention to be bound by any theory presented in the preceding background of the invention or the following detailed description of the invention.

FIG. 1 is a block diagram of one embodiment of a control system 100 comprising a system for validating the occurrence of a predetermined event and/or change in configuration. In various embodiments, control system 100 may be implemented on a spacecraft, an aircraft, a motor vehicle, or other similar vehicle. At least in the illustrated embodiment, control system 100 comprises a sensor 110 and a plurality of processors 120 ₁-120 _(n) coupled to sensor 110 via a bus 130 (e.g., a wired and/or wireless bus).

Sensor 110 may be any sensor known in the art or developed in the future capable of detecting a predetermined event and/or change in configuration in the spacecraft, aircraft, motor vehicle, or other similar vehicle. For example, sensor 110 may be a clock, a contact sensor, and/or any other type of sensor capable of detecting a predetermined event and/or change in configuration, and communicating detection of the occurrence of such event and/or configuration change to processors 120 ₁-120 _(n).

Processors 120 ₁-120 _(n), in one embodiment, are redundant processors configured to control one or more systems on the spacecraft, aircraft, motor vehicle, or other similar vehicle. For example, a first processor 120 ₁ may be the primary processor, while a secondary processor 120 ₂ may be utilized to back up processor 120 ₁, another secondary processor 120 ₃ may be utilized to back up secondary processor 120 ₂, and so forth depending on the desired level of redundancy.

In another embodiment, control system 100 may include multiple types of primary processors 120 ₁, each primary processor 120 ₁ being configured to control one or more different systems on the spacecraft, aircraft, motor vehicle, or other similar vehicle and including secondary processors 120 ₂ and/or 120 ₃. For example, a first primary processor 120 ₁ may be configured to control the navigation system, a second primary processor 120 ₁ may be configured to control a ventilation system, a third primary processor 120 ₁ may be an autopilot system, and so forth up to and including N number of primary processors 120 ₁ (and respective secondary processors 120 ₂ and/or 120 ₃) configured to perform a particular function on the spacecraft, aircraft, motor vehicle, or other similar vehicle.

Processors 120 ₁-120 _(n), in one embodiment, are configured to receive notice from sensor 110 at substantially the same time that the predetermined event occurred and/or that there has been a change in configuration. Furthermore, processors 120 ₁-120 _(n) are configured to communicate with one another (via bus 130) that they each received the notice from sensor 110. Processors 120 ₁-120 _(n) are further configured to determine the number of processors 120 ₁-120 _(n) that acknowledged receiving such notice. Moreover, processors 120 ₁-120 _(n) are configured to determine if a majority of processors 120 ₁-120 _(n) acknowledged receipt of such notice.

In one embodiment, if a majority of processors 120 ₁-120 _(n) acknowledged receipt of the notice from sensor 110, processors 120 ₁-120 _(n) are capable of reconfiguring themselves to perform at least one different function. In one embodiment, processors 120 ₁-120 _(n) are capable of reconfiguring themselves within one cycle of acknowledging receipt of the notice from sensor 110, and at substantially the same time. If a majority of processors 120 ₁-120 _(n) do not acknowledge receipt of the notice from sensor 110, processors 120 ₁-120 _(n) do not reconfigure themselves.

In a further embodiment, processors 120 ₁-120 _(n) are configured to receive a second notice (at substantially the same time) from sensor 110 that a second predetermined event occurred. Here, processors 120 ₁-120 _(n) are configured to communicate with one another (via bus 130) that they each received the second notice from sensor 110. Processors 120 ₁-120 _(n) then again determine the number of processors 120 ₁-120 _(n) that acknowledged receiving the second notice to determine if a majority of processors 120 ₁-120 _(n) acknowledged receipt of the second notice.

If a majority of processors 120 ₁-120 _(n) acknowledged receipt of the second notice, processors 120 ₁-120 _(n) reconfigure themselves to cease performing the different function(s). In one embodiment, processors 120 ₁-120 _(n) reconfigure themselves within one cycle of acknowledging receipt of the second notice from sensor 110, and at substantially the same time. If a majority of processors 120 ₁-120 _(n) do not acknowledge receipt of the second notice from sensor 110, processors 120 ₁-120 _(n) continue performing the different function(s).

While FIG. 1 illustrates control system 100 comprising a single sensor 110, the invention is not limited to such a configuration. That is, other embodiments may use a plurality of sensors to detect the occurrence of the predetermined event and/or change in configuration.

FIG. 2 is a block diagram of one embodiment of a control system 200 comprising a system for validating the occurrence of a predetermined event. In various embodiments, control system 200 may be implemented on a spacecraft, an aircraft, a motor vehicle, or other similar vehicle. At least in the illustrated embodiment, control system 200 comprises three sensors 210 ₁-210 ₃ and a plurality of processors 220 ₁-220 _(n) coupled to sensors 210 ₁-210 ₃ via a bus 230 (e.g., a wired and/or wireless bus).

Sensors 210 ₁-210 ₃ may each be any sensor known in the art or developed in the future capable of detecting a predetermined event and/or change in configuration in the spacecraft, aircraft, motor vehicle, or other similar vehicle. In one embodiment, sensors 210 ₁-210 ₃ are the same type of sensor. For example, sensors 210 ₁-210 ₃ may each be a clock, a contact sensor, a device configured to detect an action performed by a human (e.g., the actuation of a button, switch, lever, etc.), and/or any other type of sensor capable of detecting a predetermined event and/or change in configuration. In another embodiment, at least two of sensors 210 ₁-210 ₃ are different types of sensors. For example, a sensor 210 ₁ may be a clock and sensor 210 ₂ and 210 ₃ may be contact sensors; or a sensor 210 ₁ may be a clock, a sensor 210 ₂ may be a contact sensor, and a sensor 210 ₃ may be configured to detect an action performed by a human. In both embodiments, sensors 210 ₁-210 ₃ are configured to communicate detection of the occurrence of such event and/or configuration change to processors 220 ₁-220 _(n).

Each processor 220 is configured to control one or more systems on the spacecraft, aircraft, motor vehicle, or other similar vehicle. For example, a processor 220 ₁ may be configured to control the navigation system, a processor 220 ₂ may be configured to control a ventilation system, a processor 220 ₃ may be configured to monitor a fuel system, a processor 220 ₄ configured to function as an autopilot, etc. up to and including a processor 220 _(n) configured to perform particular functions on the spacecraft, aircraft, motor vehicle, or other similar vehicle.

Furthermore, one or more of processors 220 ₁-220 _(n) may include one or more redundant or backup processors configured to perform the function(s) of their respective primary processors in the unlikely event of a processor malfunction. In one embodiment, one or more of processors 220 ₁-220 _(n) includes a single backup processor. In another embodiment, one or more of processors 220 ₁-220 _(n) includes two or more backup processors.

Processors 220 ₁-220 _(n), in one embodiment, are configured to receive notice from sensors 210 ₁-210 ₃, at substantially the same time, that the predetermined event occurred and/or that the change in configuration occurred for which each sensor 210 is responsible for detecting. Processors 220 ₁-220 _(n) are further configured to determine if a majority of sensors 210 ₁-210 ₃ have detected and transmitted notice that the predetermined event occurred and/or that the change in configuration has occurred.

Processors 220 ₁-220 _(n) are further configured to communicate with one another (via bus 230) that they each received a notice from a majority of sensors 210 ₁-210 ₃. In addition, processors 220 ₁-220 _(n) are configured to determine the number of processors 220 ₁-220 _(n) that acknowledged receiving such notice. Moreover, processors 220 ₁-220 _(n) are configured to determine if a majority of processors 220 ₁-220 _(n) acknowledged receipt of notice from the majority of sensors 210 ₁-210 ₃.

In one embodiment, if a majority of processors 220 ₁-220 _(n) acknowledged receipt of the notice from a majority of sensors 210 ₁-210 ₃, processors 220 ₁-220 _(n) are configured to reconfigure themselves to perform at least one different function. In one embodiment, processors 220 ₁-220 _(n) are capable of reconfiguring themselves within one cycle of acknowledging receipt of the notice from a majority of sensors 210 ₁-210 ₃, and at substantially the same time. If a majority of processors 220 ₁-220 _(n) do not acknowledge receipt of the notice from a majority of sensors 210′-210 ₃, processors 220 ₁-220 _(n) do not reconfigure themselves.

In a further embodiment, processors 220 ₁-220 _(n) are configured to receive a second notice (at substantially the same time) from sensors 210 ₁-210 ₃ that a second predetermined event occurred. Here, processors 220 ₁-220 _(n) are configured to communicate with one another (via bus 230) that they each received the second notice from a majority of sensors 210 ₁-210 ₃. Processors 220 ₁-220 _(n) then again determine the number of processors 220 ₁-220 _(n) that acknowledged receiving the second notice from a majority of sensors 210 ₁-210 ₃ and determine if a majority of processors 220 ₁-220 _(n) acknowledged receipt of the second notice.

If a majority of processors 220 ₁-220 _(n) acknowledged receipt of the second notice from a majority of sensors 210 ₁-210 ₃, processors 220 ₁-220 _(n) reconfigure themselves to cease performing the different function(s). In one embodiment, processors 220 ₁-220 _(n) reconfigure themselves within one cycle of acknowledging receipt of the second notice from a majority of sensors 210 ₁-210 ₃, and at substantially the same time. If a majority of processors 220 ₁-220 _(n) do not acknowledge receipt of the second notice from a majority of sensors 210 ₁-210 ₃, processors 220 ₁-220 _(n) continue performing the different function(s).

FIG. 3 is a block diagram illustrating embodiments of predetermined events and/or change in configurations for two control systems 100 ₁ and 100 ₂, which are each similar to control system 100 discussed above with reference to FIG. 1. In one embodiment, a first predetermined event and/or change in configuration is combining control systems 100 ₁ and 100 ₂ to form a single control system 300, which is capable of being detected by sensors 110 ₁ and 110 ₂ and transmitted to processors 120 ₁₁-120 _(1n) and 120 ₂₁-120 _(2n), respectively. In another embodiment (e.g., where sensors 110 ₁ and 110 ₂ are clocks), a first predetermined event may be the elapse of a predetermined amount of time from a particular point in time (e.g., a time of launch, take-off, etc.).

In this embodiment, processors 120 ₁₁-120 _(1n) and 120 ₂₁-120 _(2n), form a single system after control system 300 is formed. That is, processors 120 ₁₁-120 _(1n) and 120 ₂₁-120 _(2n) each reconfigure themselves (at substantially the same time) to communicate with one another and to perform at least one additional feature after processors 120 ₁₁-120 _(1n) and 120 ₂₁-120 _(2n) receive notice of the first predetermined event and/or change in configuration. For example, processors 120 ₁₁ and 120 ₂₁ may each be responsible for navigating their respective crafts; however, once the crafts are combined, processor 120 ₁₁ (and secondary processors 120 ₁₂ 120 _(1n)) may reconfigure itself to navigate the combined craft, while processor 120 ₂₁ (and secondary processors 120 ₂₂-120 _(2n)) may be disconnected, configured to perform a new function, or reconfigure itself to be a backup for processor 120 ₁₁.

In another embodiment, a second predetermined event and/or change in configuration is the separation of control systems 100 ₁ and 100 ₂ from control system 300, which is capable of being detected by sensors 110 ₁ and 110 ₂ and transmitted to processors 120 ₁₁-120 _(1n) and 120 ₂₁-120 _(2n), respectively. In another embodiment (e.g., where sensors 110 ₁ and 110 ₂ are clocks), the second predetermined event may be the elapse of a predetermined amount of time from a particular point in time (e.g., a time of launch, take-off, combining of control systems 110 ₁ and 110 ₂, etc.). In this embodiment, once separation has occurred, processors 120 ₁₁-120 _(1n) and 120 ₂₁-120 _(2n) again reconfigure themselves (at substantially the same time) to return to their respective pre-combination functions.

FIG. 4 is a block diagram illustrating embodiments of predetermined events and/or change in configurations for two control systems 200 ₁ and 200 ₂, which are each similar to control system 200 discussed above with reference to FIG. 2. In one embodiment, a first predetermined event and/or change in configuration is combining control systems 200 ₁ and 200 ₂ to form a single control system 400, which is capable of being detected by sensors 210 ₁₁-210 ₁₃ and 210 ₂₁-210 ₂₃ and transmitted to processors 220 ₁₁-220 _(1n) and 220 ₂₁-220 _(2n), respectively. In another embodiment (e.g., where sensors 210 ₁₁-210 ₁₃ and 210 ₂₁-210 ₂₃ are clocks), the first predetermined event may be the elapse of a predetermined amount of time from a particular point in time (e.g., a time of launch, take-off, etc.).

In this embodiment, processors 220 ₁₁-220 _(1n) and 220 ₂₁-220 _(2n) form a single system after control system 400 is formed. That is, processors 220 ₁₁-220 _(1n) and 220 ₂₁-220 _(2n) each reconfigure themselves (at substantially the same time) to communicate with one another and to perform at least one additional feature after processors 220 ₁₁-220 _(1n) and 220 ₂₁-220 _(2n) receive notice of the predetermined event and/or change in configuration. For example, processors 120 ₁₁ and 220 ₂₁ may each be responsible for navigating their respective crafts; however, once the crafts are combined, processor 220 ₁₁ (and secondary processors 220 ₁₂-220 _(1n)) may reconfigure itself to navigate the combined craft, while processor 220 ₂₁ (and secondary processors 220 ₂₂-220 _(2n)) may be disconnected, configured to perform a new function, or reconfigure itself to be a backup for processor 220 ₁₁.

In another embodiment, a second predetermined event and/or change in configuration is the separation of control systems 200 ₁ and 200 ₂ from control system 300, which is capable of being detected by sensors 210 ₁₁-210 ₁₃ and 210 ₂₁-210 ₂₃, and transmitted to processors 220 ₁₁-220 _(1n) and 220 ₂₁-220 _(2n), respectively. In another embodiment (e.g., where sensors 210 ₁₁-210 ₁₃ and 210 ₂₁-210 ₂₃ are clocks), the second predetermined event may be the elapse of a predetermined amount of time from a particular point in time (e.g., a time of launch, take-off, combining of control systems 210 ₁ and 210 ₂, etc.). In this embodiment, once separation has occurred, processors 220 ₁₁-220 _(1n) and 220 ₂₁-220 _(2n) again reconfigure themselves (at substantially the same time) to return to their respective pre-combination functions.

In yet another exemplary embodiment, sensors 210 ₁₁-210 ₁₃ and 210 ₂₁-210 ₂₃ may be different types of sensors. For example, sensors 210 ₁₁ and 210 ₂₁ may be clocks, sensors 210 ₁₂ and 210 ₂₂ may be contact sensors, and sensors 210 ₁₃ and 210 ₂₃ may be configured to detect a human action (e.g., actuation of a button, switch, lever, etc.). In this embodiment, processors 220 ₁₁-220 _(1n) reconfigure themselves after a majority of processors 220 ₁₁-220 _(1n) indicate that they received notice of the detection of the predetermined event and/or change in configuration from a majority of sensors 210 ₁₁-210 ₁₃. Likewise, processors 220 ₂₁-220 _(2n) reconfigure themselves after a majority of processors 220 ₂₁-220 _(2n) indicate that they received notice of the detection of the predetermined event and/or change in configuration from a majority of sensors 210 ₂₁-210 ₂₃. For example, if control systems 200 ₁ and 200 ₂ are scheduled to combine at a predetermined time after launch, for a majority of respective sensors 210 ₁₁-210 ₁₃ and 210 ₂₁-210 ₂₃ to detect the combining of control systems 200 ₁ and 200 ₂ (i.e., the predetermined event and/or change in configuration), at least two of the following conditions must be detected: sensors 210 ₁₁ and 210 ₂₁ detect that the predetermined amount of time has lapsed, sensors 210 ₁₂ and 210 ₂₂ detect contact between control systems 200 ₁ and 200 ₂, and sensors 210 ₁₃ and 210 ₂₃ detect that a human has actuated a switch, button, lever, etc. confirming that control systems 200 ₁ and 200 ₂ have combined. Furthermore, for processors 220 ₁₁-220 _(1n) and 220 ₂₁-220 _(2n) to reconfigure themselves, a majority of processors 220 ₁₁-220 _(1n) and 220 ₂₁-220 _(2n) need to confirm that they received notice from a majority of their respective sensors 220.

While at least one exemplary embodiment has been presented in the foregoing detailed description of the invention, it should be appreciated that a vast number of variations exist. It should also be appreciated that the exemplary embodiment or exemplary embodiments are only examples, and are not intended to limit the scope, applicability, or configuration of the invention in any way. Rather, the foregoing detailed description will provide those skilled in the art with a convenient road map for implementing an exemplary embodiment of the invention, it being understood that various changes may be made in the function and arrangement of elements described in an exemplary embodiment without departing from the scope of the invention as set forth in the appended claims and their legal equivalents. 

1. A method for validating an occurrence of a predetermined event in a plurality of redundant processors operating in a first mode coupled to three redundant sensors, the method comprising the steps of: receiving, by the plurality of redundant processors, a notice from two of the three redundant sensors that the predetermined event occurred; and reconfiguring the plurality of redundant processors to operate in a second mode in response to the notice.
 2. The method of claim 1, wherein the notice is received by the plurality of redundant processors at substantially a same time.
 3. The method of claim 1, wherein the reconfiguring step further comprises the step of reconfiguring each redundant processor at substantially a same time.
 4. The method of claim 3, further comprising the steps of: communicating, by a first redundant processor, to a second redundant processor receipt of the notice prior to reconfiguring; and communicating, by the second redundant processor, to the first redundant processor receipt of the notice prior to reconfiguring.
 5. The method of claim 1, wherein the reconfiguring step comprises the step of reconfiguring each redundant processor within one clock cycle of receiving the notice.
 6. The method of claim 5, wherein the reconfiguring step further comprises the step of reconfiguring each redundant processor at substantially a same time.
 7. The method of claim 6, further comprising the steps of: communicating, by a first redundant processor, to a second redundant processor receipt of the notice prior to reconfiguring; and communicating, by the second redundant processor, to the first redundant processor receipt of the notice prior to reconfiguring.
 8. The method of claim 1, further comprising the step of determining, by the two of the three redundant sensors, that the predetermined event occurred, wherein the predetermined event is an elapse of a predetermined amount of time.
 9. The method of claim 1, further comprising the steps of: detecting, by one of the two redundant sensors, that the predetermined event occurred; and detecting, by another one of the two redundant sensors, user confirmation that the predetermined event occurred.
 10. A method for validating that a first vehicle operating in a first mode is coupled to a second vehicle operating in a second mode, the first vehicle comprising a first primary control system, a first secondary control system for the first primary control system, and a first sensor coupled to the first primary control system and the first of secondary control system, the method comprising the steps of: receiving, at the first primary control system and the first secondary control system, a first notice that the first sensor detected that the first vehicle is coupled to the second vehicle; and reconfiguring the first primary control system and the first secondary control system to operate in a third mode at substantially the same time in response to the first notice.
 11. The method of claim 10, wherein the first primary control system and the first secondary control system are each reconfigured within one clock cycle of receiving the first notice.
 12. The method of claim 10, wherein the second vehicle comprises a second primary control system, a second secondary control system for the second primary control system, and a second sensor coupled to the second primary control system and the second secondary control system, the method further comprising the steps of: receiving, at the second primary control system and the second secondary control system, a second notice that the second sensor detected that the second vehicle is coupled to the first vehicle; and reconfiguring the second primary control system and the second secondary control system to operate in the third mode at substantially the same time in response to the second notice.
 13. The method of claim 12, wherein: the first primary control system and the first secondary control system are each reconfigured within one clock cycle of receiving the first notice; and the second primary control system and the second secondary control system are each reconfigured within one clock cycle of receiving the second notice.
 14. The method of claim 10, wherein the first vehicle and the second vehicle are spacecraft.
 15. A method for validating that a first vehicle operating in a first mode is coupled to a second vehicle operating in a second mode, the first vehicle comprising a first primary control system, a first secondary control system for the first primary control system, and a first sensor, a second sensor, and a third sensor coupled to the first primary control system and the first secondary control system, the method comprising the steps of: receiving, at the first primary control system and the first secondary control system, a first notice that at least two of the first sensor, the second sensor, and the third sensor detected that the first vehicle is coupled to the second vehicle; and reconfiguring the first primary control system and the first secondary control system to operate in a third mode at substantially the same time in response to the first notice.
 16. The method of claim 15, wherein the first primary control system and the first secondary control system are each reconfigured within one clock cycle of receiving the first notice.
 17. The method of claim 15, wherein the second vehicle comprises a second primary control system, a second secondary control system for the second primary control system, and a fourth sensor, a fifth sensor, and a sixth sensor coupled to the second primary control system and the second secondary control system, the method further comprising the steps of: receiving, at the second primary control system and the second secondary control system, a second notice that at least two of the fourth sensor, the fifth sensor, and the sixth sensor detected that the second vehicle is coupled to the first vehicle; and reconfiguring the second primary control system and the second secondary control system to operate in the third mode at substantially the same time in response to the second notice.
 18. The method of claim 17, wherein: the first primary control system and the first secondary control system are each reconfigured within one clock cycle of receiving the first notice; and the second primary control system and the second secondary control system are each reconfigured within one clock cycle of receiving the second notice.
 19. The method of claim 15, wherein the first vehicle and the second vehicle are spacecraft. 